😭 WSOB is a python tool created to exploit the new vulnerability on WSO2 assigned as CVE-2022-29464.

Last update: Oct 14, 2022

Overview

😭 WSOB (CVE-2022-29464)

😭 WSOB is a python tool created to exploit the new vulnerability on WSO2 assigned as CVE-2022-29464.

CVE-2022-29464 details:

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 and above through 4.0.0; WSO2 Identity Server 5.2.0 and above through 5.11.0; WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, and 5.6.0; WSO2 Identity Server as Key Manager 5.3.0 and above through 5.10.0; and WSO2 Enterprise Integrator 6.2.0 and above through 6.6.0.

Source: https://nvd.nist.gov/vuln/detail/CVE-2022-29464

⚡ Installing / Getting started

A quick guide of how to install and use WSOB.

1. Clone the repository - git clone https://github.com/oppsec/wsob.git
2. Install the libraries - pip3 install -r requirements.txt
3. Run WSOB2 - python3 main.py -u https://example.com

⚙️ Pre-requisites

Python 3 installed on your machine.
Install the libraries with pip3 install -r requirements.txt

🔨 Contributing

A quick guide of how to contribute with the project.

1. Create a fork from WSOB repository
2. Download the project with git clone https://github.com/your/wsob.git
3. Make your changes
4. Commit and make a git push
5. Open a pull request

🙏 Credits

Credits to hakivvi for the original exploit

⚠️ Warning

The developer is not responsible for any malicious use of this tool.

You might also like...

Vulnerability Scanner & Auto Exploiter You can use this tool to check the security by finding the vulnerability in your website or you can use this tool to Get Shells

About create a target list or select one target, scans then exploits, done! Vulnnr is a Vulnerability Scanner & Auto Exploiter You can use this tool t

108 Dec 4, 2021

DNSpooq - dnsmasq cache poisoning (CVE-2020-25686, CVE-2020-25684, CVE-2020-25685)

Releases(0.2)

0.2(Jul 6, 2022)
0.2 - 2022-07-24

Improved the code

Fixed not verifying the status code to determine if target is vulnerable

Changed application banner

New banner image on README

Added description to exploit function

Updated application UI

Full Changelog: https://github.com/oppsec/WSOB/commits/0.2
Source code(tar.gz)
Source code(zip)

😭 WSOB is a python tool created to exploit the new vulnerability on WSO2 assigned as CVE-2022-29464.

Related tags

Overview

😭 WSOB (CVE-2022-29464)

CVE-2022-29464 details:

⚡ Installing / Getting started

⚙️ Pre-requisites

🔨 Contributing

🙏 Credits

⚠️ Warning

You might also like...

Vulnerability Scanner & Auto Exploiter You can use this tool to check the security by finding the vulnerability in your website or you can use this tool to Get Shells

DNSpooq - dnsmasq cache poisoning (CVE-2020-25686, CVE-2020-25684, CVE-2020-25685)

This repository detects a system vulnerable to CVE-2022-21907 and protects against this vulnerability if desired

CVE-2022-21907 Vulnerability PoC

CVE-2022-23046 - SQL Injection Vulnerability on PhpIPAM v1.4.4

HTTP Protocol Stack Remote Code Execution Vulnerability CVE-2022-21907

Exploit and Check Script for CVE 2022-1388

Dockerized Spring4Shell (CVE-2022-22965) PoC application and exploit

Exploit tool for Adminer 1.0 up to 4.6.2 Arbitrary File Read vulnerability

Releases(0.2)

0.2(Jul 6, 2022)

0.2 - 2022-07-24

Owner

0p

BETA: Layla - recon tool for bug bounty

zip-brute Zip File Password Cracking with Using Password List

大宝剑-信息收集和资产梳理工具（红队、蓝队、企业组织架构、子域名、Web资产梳理、Web指纹识别、ICON_Hash资产匹配）

cve-2021-21985 exploit

The backend part of the simple password manager project made for the creative challenge.

Bypass 4xx HTTP response status codes.

A scanner and a proof of sample exploit for log4j RCE CVE-2021-44228

MongoDB-Injection - This challenge-script is custom-made for web-server running MongoDB which is vulnerable to No-SQL injection

This program will brute force any Instagram account you send it its way given a list of proxies.

SubFind - Subdomain Finder Tools

Xteam All in one Instagram,Android,phishing osint and wifi hacking tool available

A Modified version of TCC's Osprey poc framework......

Chrome Post-Exploitation is a client-server Chrome exploit to remotely allow an attacker access to Chrome passwords, downloads, history, and more.

Python APK Reverser & Patcher Tool

Course: Information Security with Python

A brute Force tool for Facebook

Python program that generates secure passwords.

MSDorkDump is a Google Dork File Finder that queries a specified domain name and variety of file extensions

RedDrop is a quick and easy web server for capturing and processing encoded and encrypted payloads and tar archives.

对naabu的端口扫描结果，调用nmap进行指纹识别